FIDO FIDO Deployment & Implementation Architecture 1 — Questions and Answers
Question 1: What is the primary role of a Relying Party (RP) in a FIDO2 deployment?
- A web service or application that accepts FIDO-based authentication credentials (Correct answer)
- A hardware token manufacturer that produces FIDO-certified devices
- A certificate authority that issues TLS certificates for FIDO servers
- A middleware component that proxies authentication requests to an identity provider
Correct answer: A web service or application that accepts FIDO-based authentication credentials
A Relying Party is the web service or application that verifies FIDO credentials during authentication and registration ceremonies.
Question 2: Which component in a FIDO2 architecture is responsible for storing the credential public key after registration?
- The authenticator device
- The FIDO Alliance metadata service
- The Relying Party server (Correct answer)
- The WebAuthn browser API
Correct answer: The Relying Party server
The Relying Party server stores the user's credential public key and credential ID after a successful registration ceremony.
Question 3: During a FIDO2 WebAuthn registration ceremony, what does the Relying Party send to the client to initiate the process?
- A signed certificate request
- A challenge nonce and RP identity information (Correct answer)
- The user's existing password hash
- A one-time password via SMS
Correct answer: A challenge nonce and RP identity information
The Relying Party sends a random challenge nonce along with RP identity information (rpId, rpName) to start the registration ceremony.
Question 4: What is the purpose of the 'origin' validation step performed by the Relying Party during a WebAuthn ceremony?
- To check the geographic location of the user
- To verify the request originated from the legitimate RP domain, preventing phishing (Correct answer)
- To confirm the authenticator firmware version is up to date
- To ensure the user has a valid email address on file
Correct answer: To verify the request originated from the legitimate RP domain, preventing phishing
Origin validation ensures the WebAuthn ceremony was initiated from the expected RP domain, making FIDO inherently phishing-resistant.
Question 5: In a FIDO2 server implementation, what does the 'rpId' field represent?
- A unique numeric identifier assigned by the FIDO Alliance
- The effective domain of the Relying Party used to scope credentials (Correct answer)
- A session token for the current authentication transaction
- The SHA-256 hash of the server's TLS certificate
Correct answer: The effective domain of the Relying Party used to scope credentials
The rpId is the effective domain (e.g., 'example.com') that scopes credentials, ensuring they can only be used on that domain or its subdomains.
Question 6: Which deployment model allows a single FIDO2 credential to be used across multiple services under the same organization?
- Cross-origin iframe embedding
- Federated identity with rpId set to the parent domain (Correct answer)
- Shared secret symmetric key distribution
- SAML 2.0 assertion passing
Correct answer: Federated identity with rpId set to the parent domain
Setting the rpId to a parent domain (e.g., 'company.com') allows subdomains like 'app1.company.com' and 'app2.company.com' to share credentials.
FIDO FIDO Deployment & Implementation Architecture 1
What is the primary role of a Relying Party (RP) in a FIDO2 deployment?